VSCodeTunnel - description

Visual Studio Code provides a feature that allows users to create a remote tunnel through Microsoft servers, enabling remote development on any machine with VS Code installed. Threat actors have been observed abusing this feature to create a command and control (C&C) channel using legitimate Microsoft infrastructure. Because this technique uses the authentic, Microsoft-signed VS Code binary to establish the C&C channel, some endpoint detection and response (EDR) systems may not detect it.

Flowmon ADS detects network traffic associated with the VS Code tunnel feature, which may indicate unauthorized remote access to a host.

Sources:

• Chinese APT abuses VS Code to target government in Asia
• VS Code tunnel abuse demonstration
• VS Code tunnel technique analysis by Wietze Beukema